Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump VMs, to Ubuntu 2204 with cgroups v1 #14972

Merged
merged 1 commit into from
Jul 22, 2022
Merged

Bump VMs, to Ubuntu 2204 with cgroups v1 #14972

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 6 additions & 5 deletions .cirrus.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,11 +29,11 @@ env:
####
FEDORA_NAME: "fedora-36"
#PRIOR_FEDORA_NAME: "fedora-35"
UBUNTU_NAME: "ubuntu-2110"
UBUNTU_NAME: "ubuntu-2204"

# Image identifiers
IMAGE_SUFFIX: "c6211193021923328"
FEDORA_AMI_ID: "ami-06a41d8a81ab56afa"
IMAGE_SUFFIX: "c6013173500215296"
FEDORA_AMI_ID: "ami-0f116746f31965e41"
# Complete image names
FEDORA_CACHE_IMAGE_NAME: "fedora-${IMAGE_SUFFIX}"
#PRIOR_FEDORA_CACHE_IMAGE_NAME: "prior-fedora-${IMAGE_SUFFIX}"
Expand Down Expand Up @@ -178,8 +178,7 @@ build_task:
DISTRO_NV: ${UBUNTU_NAME}
VM_IMAGE_NAME: ${UBUNTU_CACHE_IMAGE_NAME}
CTR_FQIN: ${UBUNTU_CONTAINER_FQIN}
# FIXME 2022-07-12: change to runc once #14833 is fixed!
CI_DESIRED_RUNTIME: crun
CI_DESIRED_RUNTIME: runc
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@edsantiago I don't remember checking this or not, so maybe a duplicate comment: In lib.sh there is a list of "pass-through" env. var. names. Please make sure this one is on that list to ensure the variable and value are passed into (for example) rootless and podman-in-podman CI scripts.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a really good point, thanks. It looks like the test passed in int-rootless, but not in containerized, so I have work to do. I've also added a triple-check so the test will fail if $CIRRUS_CI is defined but $CI_DESIRED_RUNTIME is not.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oof, one thing to watch out for here is: I don't think we set CIRRUS_CI=true or CI=true in hack/get_ci_env.sh. However that script automatically runs setup_environment.sh for developers before handing them a shell. So checks against those vars could cause problems.

BTW, have you tried hack/get_ci_vm.sh recently? For a number of months, it has been updated to not require sudo, only runs rootless, and only touches files under your ~/.config/gcloud directory. All things you took issue with in the past. Anyway...in case it's useful for you. It's certainly faster for debugging CI changes than waiting for CIrrus to run them.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did try get_ci_vm.sh 2-3 weeks ago, rootless (thank you!), but it failed with a long complicated error that I couldn't figure out. I tried a reset(?) arg, still failed. Gave up.

It's 100% OK if $CIRRUS_DESIRED_RUNTIME is set without $CIRRUS_CI. What is not OK is the converse. And I think (fingers crossed) that this iteration, the one running in CI just now, handles all the corner cases. We'll see in two hours.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

failed with a long complicated error

That may have been the SNAFU w/ AWS. Should be fixed now.

I tried a reset(?) arg, still failed. Gave up.

You can try completely removing ~/.config/gcloud worst-case. Everythnig in there is generated automatically. All you'll have to do is re-init (do the browser URL copy-paste thing, select region, etc.).

env:
TEST_FLAVOR: build
clone_script: *full_clone
Expand Down Expand Up @@ -550,6 +549,7 @@ container_integration_test_task:
_BUILD_CACHE_HANDLE: ${FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
VM_IMAGE_NAME: ${FEDORA_CACHE_IMAGE_NAME}
CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
CI_DESIRED_RUNTIME: crun
#- env:
#DISTRO_NV: ${PRIOR_FEDORA_NAME}
#_BUILD_CACHE_HANDLE: ${PRIOR_FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
Expand Down Expand Up @@ -667,6 +667,7 @@ rootless_remote_system_test_task:
CTR_FQIN: ${FEDORA_CONTAINER_FQIN}
# ID for re-use of build output
_BUILD_CACHE_HANDLE: ${FEDORA_NAME}-build-${CIRRUS_BUILD_ID}
CI_DESIRED_RUNTIME: crun
<<: *local_system_test_task
alias: rootless_remote_system_test
depends_on:
Expand Down
1 change: 1 addition & 0 deletions contrib/cirrus/runner.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,6 +246,7 @@ function _run_build() {
if [[ "$runtime" != "$CI_DESIRED_RUNTIME" ]]; then
die "Built podman is using '$runtime'; this CI environment requires $CI_DESIRED_RUNTIME"
fi
msg "Built podman is using expected runtime='$runtime'"
}

function _run_altbuild() {
Expand Down
23 changes: 8 additions & 15 deletions contrib/cirrus/setup_environment.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,27 +71,20 @@ fi

cd "${GOSRC}/"

# Defined by lib.sh: Does the host support cgroups v1 or v2
# Defined by lib.sh: Does the host support cgroups v1 or v2? Use runc or crun
# respectively.
# **IMPORTANT**: $OCI_RUNTIME is a fakeout! It is used only in e2e tests.
# For actual podman, as in system tests, we force runtime in containers.conf
case "$CG_FS_TYPE" in
tmpfs)
if ((CONTAINER==0)); then
warn "Forcing testing with runc instead of crun"
if [[ "$OS_RELEASE_ID" == "ubuntu" ]]; then
# Need b/c using cri-o-runc package from OBS
echo "OCI_RUNTIME=/usr/lib/cri-o-runc/sbin/runc" \
>> /etc/ci_environment
else
echo "OCI_RUNTIME=runc" >> /etc/ci_environment
fi
echo "OCI_RUNTIME=runc" >> /etc/ci_environment
printf "[engine]\nruntime=\"runc\"\n" >>/etc/containers/containers.conf
fi
;;
cgroup2fs)
if ((CONTAINER==0)); then
# This is necessary since we've built/installed from source,
# which uses runc as the default.
warn "Forcing testing with crun instead of runc"
echo "OCI_RUNTIME=crun" >> /etc/ci_environment
fi
# Nothing to do: podman defaults to crun
;;
*) die_unknown CG_FS_TYPE
esac
Expand Down Expand Up @@ -368,7 +361,7 @@ case "$TEST_FLAVOR" in
slug="gitlab.com/gitlab-org/gitlab-runner"
helper_fqin="registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-latest-pwsh"
ssh="ssh $ROOTLESS_USER@localhost -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o CheckHostIP=no env GOPATH=$GOPATH"
showrun $ssh go get -u github.com/jstemmer/go-junit-report
showrun $ssh go install github.com/jstemmer/go-junit-report/[email protected]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A comment explaining why this is necessary would be helpful. Our setup for running the gitlab unit tests was carefully crafted based on explicit instructions from the gitlab runner maintainers. I don't recall this version-reference being in them. But in general, our task should simply follow the "latest and greatest" upstream. If we deviate and it breaks, it can be time-consuming to engage with them (they have other priorities).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

go get simply does not work with go 1.18, you have to go install.

You could add @latest to always use the latest but IMO this will just start breaking on a random PR, we really have to stop doing this and only update versions via PRs. I am tired of having things break on my PRs because of external changes.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Furthermore: I cannot find anywhere in that file where it says "this is carefully crafted from anything". If this is fragile code, it must include comments saying so and linking to exact instructions (e.g. on gitlab.com).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not 'go installing' for podman, it's doing so for the upstream gitlab tests.

I cannot find anywhere in that file where it says

Hrmmm, I thought I had left a comment about that...Yeah, it's this one:
# Ref: https://gitlab.com/gitlab-org/gitlab-runner/-/issues/27270#note_499585550

but you're right, it's not clear at all how specialized this setup is. I s'pose was unintentionally relying on the sheer volume of setup section steps in that link. I'll post a docs PR to make it more clear.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

#15030

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMHO, I think Paul's idea is probably okay, so:

showrun $ssh go install github.com/jstemmer/go-junit-report/v2@latest

This tool is only needed at the very end of testing, and AFAIK only used to check and convert the results into a useful (for upstream developers) format.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Luap99's idea is to use a strict version, not @latest, and I ferociously agree. I despise using latest because, as Paul, states, it always leads to surprise failures at the least convenient time.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Normally yes, but this is a different context. And there's always the allow_failures: ... un-comment option since these aren't "our" tests anyway. That said, we can roll with the fixed version, but if it breaks, somebody will need to work with the gitlab-runner upstream to fix it (same as for any other gitlab test failure I s'pose).

showrun $ssh git clone https://$slug $GOPATH/src/$slug
showrun $ssh make -C $GOPATH/src/$slug development_setup
showrun $ssh bash -c "'cd $GOPATH/src/$slug && GOPATH=$GOPATH go get .'"
Expand Down
4 changes: 3 additions & 1 deletion test/e2e/build_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -524,6 +524,8 @@ subdir**`
// See https://github.com/containers/podman/issues/13535
It("Remote build .containerignore filtering embedded directory (#13535)", func() {
SkipIfNotRemote("Testing remote .containerignore file filtering")
Skip("FIXME: #15014: test times out in 'dd' on f36.")

podmanTest.RestartRemoteService()

// Switch to temp dir and restore it afterwards
Expand Down Expand Up @@ -552,7 +554,7 @@ subdir**`
Expect(ioutil.WriteFile(filepath.Join(subdirPath, "extra"), contents.Bytes(), 0644)).
ToNot(HaveOccurred())
randomFile := filepath.Join(subdirPath, "randomFile")
dd := exec.Command("dd", "if=/dev/random", "of="+randomFile, "bs=1G", "count=1")
dd := exec.Command("dd", "if=/dev/urandom", "of="+randomFile, "bs=1G", "count=1")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can never remember which is the fast pseudo-random one? We should use that. The entropy-pool in these VMs is a problem we've struggled with in different contexts before.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can safely assume that if I changed it, with a corresponding acknowledgment in the commit message, it is the correct change. But you can also confirm at random(4):

When read, the /dev/urandom device returns random bytes using a pseudo-random number generator seeded from the entropy pool. Reads from this device do not block (i.e., the CPU is not yielded), but can incur an appreciable delay when requesting large amounts of data.

I'm guessing that we're hitting this delay, I just don't know what to do about it, so I'm leaving that as SEP (#15014).

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In case anybody does some archaeology on this change: GCE uses QEMU/KVM VMs and does not provide a virtual RNG for them (we asked). That means the entropy pool is incredibly limited, and we rely on the (pre-enabled) rngd service to refill it. In other words, tests should never rely on fast good random numbers, only fast less-good ones or VERY slow good ones.

ddSession, err := Start(dd, GinkgoWriter, GinkgoWriter)
Expect(err).ToNot(HaveOccurred())
Eventually(ddSession, "10s", "1s").Should(Exit(0))
Expand Down
7 changes: 5 additions & 2 deletions test/e2e/checkpoint_image_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@ var _ = Describe("Podman checkpoint", func() {
})

It("podman checkpoint --create-image with running container", func() {
SkipIfContainerized("FIXME: #15015. All checkpoint tests hang when containerized.")
// Container image must be lowercase
checkpointImage := "alpine-checkpoint-" + strings.ToLower(RandomString(6))
containerName := "alpine-container-" + RandomString(6)
Expand Down Expand Up @@ -163,7 +164,8 @@ var _ = Describe("Podman checkpoint", func() {
Expect(podmanTest.NumberOfContainersRunning()).To(Equal(0))
})

It("podman restore multiple containers from single checkpint image", func() {
It("podman restore multiple containers from single checkpoint image", func() {
SkipIfContainerized("FIXME: #15015. All checkpoint tests hang when containerized.")
// Container image must be lowercase
checkpointImage := "alpine-checkpoint-" + strings.ToLower(RandomString(6))
containerName := "alpine-container-" + RandomString(6)
Expand Down Expand Up @@ -225,7 +227,8 @@ var _ = Describe("Podman checkpoint", func() {
Expect(podmanTest.NumberOfContainersRunning()).To(Equal(0))
})

It("podman restore multiple containers from multiple checkpint images", func() {
It("podman restore multiple containers from multiple checkpoint images", func() {
SkipIfContainerized("FIXME: #15015. All checkpoint tests hang when containerized.")
// Container image must be lowercase
checkpointImage1 := "alpine-checkpoint-" + strings.ToLower(RandomString(6))
checkpointImage2 := "alpine-checkpoint-" + strings.ToLower(RandomString(6))
Expand Down
5 changes: 5 additions & 0 deletions test/e2e/checkpoint_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ var _ = Describe("Podman checkpoint", func() {

BeforeEach(func() {
SkipIfRootless("checkpoint not supported in rootless mode")
SkipIfContainerized("FIXME: #15015. All checkpoint tests hang when containerized.")
tempdir, err = CreateTempDirInTempDir()
Expect(err).To(BeNil())

Expand Down Expand Up @@ -1128,6 +1129,10 @@ var _ = Describe("Podman checkpoint", func() {
share := share // copy into local scope, for use inside function

It(testName, func() {
if podmanTest.Host.Distribution == "ubuntu" && IsRemote() {
Skip("FIXME: #15018. Cannot restore --pod under cgroupsV1 and remote")
}

if !criu.CheckForCriu(criu.PodCriuVersion) {
Skip("CRIU is missing or too old.")
}
Expand Down
15 changes: 15 additions & 0 deletions test/e2e/info_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,4 +152,19 @@ var _ = Describe("Podman Info", func() {
Expect(session.OutputToString()).To(ContainSubstring("memory"))
Expect(session.OutputToString()).To(ContainSubstring("pids"))
})

It("Podman info: check desired runtime", func() {
// defined in .cirrus.yml
want := os.Getenv("CI_DESIRED_RUNTIME")
if want == "" {
if os.Getenv("CIRRUS_CI") == "" {
Skip("CI_DESIRED_RUNTIME is not set--this is OK because we're not running under Cirrus")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it make sense to just define CI_DESIRED_RUNTIME in the Makefile? That could avoid all this checking-complexity. CI always runs through the Makefile, and any developer running locally should be doing so as well.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Absolutely not. The Makefile has no knowledge of which VMs want crun and which want runc. Only .cirrus.yml should know that.

Although these tests add some duplication, the reason is that I never, ever, ever want to go through this nightmare week again. Nor do I want anyone else to.

Copy link
Member

@cevich cevich Jul 21, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Relating to get_ci_vm.sh: $CIRRUS_CI will be unset, but $CI_DESIRED_RUNTIME will be set.

Edit: removed comment. I read the code wrong.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

if $CI_DESIRED_RUNTIME is not set
    if $CIRRUS_CI is not set
        skip, clearly indicating that this is OK

}
Fail("CIRRUS_CI is set, but CI_DESIRED_RUNTIME is not! See #14912")
}
session := podmanTest.Podman([]string{"info", "--format", "{{.Host.OCIRuntime.Name}}"})
session.WaitWithDefaultTimeout()
Expect(session).To(Exit(0))
Expect(session.OutputToString()).To(Equal(want))
})
})
1 change: 1 addition & 0 deletions test/e2e/kill_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ var _ = Describe("Podman kill", func() {
})

It("podman kill paused container", func() {
SkipIfRootlessCgroupsV1("pause is not supported for cgroupv1 rootless")
ctrName := "testctr"
session := podmanTest.RunTopContainer(ctrName)
session.WaitWithDefaultTimeout()
Expand Down
3 changes: 3 additions & 0 deletions test/e2e/manifest_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,6 +293,9 @@ var _ = Describe("Podman manifest", func() {
})

It("authenticated push", func() {
if podmanTest.Host.Distribution == "ubuntu" && IsRemote() {
Skip("FIXME: #15017. Registry times out.")
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lsm5 was fighting with this one. Not sure if he opened an issue or not. IIRC, paul suggested checking the networking and/or firewall.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah. I don't care right now. My only goal is to get this merged. Someone else will have to deal with it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I smell a massive month-long "FIXME" & bug-fix effort in the team's future 😞

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep. Absolutely. And I'm 100000% fine with that: small little chunky fixes over time. The alternative is to hold this PR until every single runc bug is fixed, which may take a month or more, and in the meantime more and more runc-related bugs will sneak in.

registryOptions := &podmanRegistry.Options{
Image: "docker-archive:" + imageTarPath(REGISTRY_IMAGE),
}
Expand Down
2 changes: 2 additions & 0 deletions test/e2e/network_connect_disconnect_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ var _ = Describe("Podman network connect and disconnect", func() {
})

It("podman network disconnect", func() {
SkipIfRootlessCgroupsV1("stats not supported under rootless CgroupsV1")
netName := "aliasTest" + stringid.GenerateNonCryptoID()
session := podmanTest.Podman([]string{"network", "create", netName})
session.WaitWithDefaultTimeout()
Expand Down Expand Up @@ -180,6 +181,7 @@ var _ = Describe("Podman network connect and disconnect", func() {
})

It("podman network connect", func() {
SkipIfRootlessCgroupsV1("stats not supported under rootless CgroupsV1")
netName := "aliasTest" + stringid.GenerateNonCryptoID()
session := podmanTest.Podman([]string{"network", "create", netName})
session.WaitWithDefaultTimeout()
Expand Down
1 change: 1 addition & 0 deletions test/e2e/pod_create_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1051,6 +1051,7 @@ ENTRYPOINT ["sleep","99999"]

It("podman pod create --share-parent test", func() {
SkipIfRootlessCgroupsV1("rootless cannot use cgroups with cgroupsv1")
SkipIfCgroupV1("FIXME: #15013: CgroupMode shows 'host' instead of CID under Cgroups V1.")
podCreate := podmanTest.Podman([]string{"pod", "create", "--share-parent=false"})
podCreate.WaitWithDefaultTimeout()
Expect(podCreate).Should(Exit(0))
Expand Down
7 changes: 6 additions & 1 deletion test/e2e/run_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,8 @@ var _ = Describe("Podman run", func() {
if exitCode == 0 {
Expect(session.OutputToString()).To(ContainSubstring("aarch64"))
} else {
Expect(session.ErrorToString()).To(ContainSubstring("Exec format error"))
// crun says 'Exec', runc says 'exec'. Handle either.
Expect(session.ErrorToString()).To(ContainSubstring("xec format error"))
}
})

Expand Down Expand Up @@ -714,6 +715,7 @@ USER bin`, BB)
})

It("podman run device-read-bps test", func() {
SkipIfCgroupV1("FIXME: #15035 - bps broken")
SkipIfRootless("FIXME: requested cgroup controller `io` is not available")
SkipIfRootlessCgroupsV1("Setting device-read-bps not supported on cgroupv1 for rootless users")

Expand All @@ -733,6 +735,7 @@ USER bin`, BB)
})

It("podman run device-write-bps test", func() {
SkipIfCgroupV1("FIXME: #15035 - bps broken")
SkipIfRootless("FIXME: requested cgroup controller `io` is not available")
SkipIfRootlessCgroupsV1("Setting device-write-bps not supported on cgroupv1 for rootless users")

Expand All @@ -751,6 +754,7 @@ USER bin`, BB)
})

It("podman run device-read-iops test", func() {
SkipIfCgroupV1("FIXME: #15035 - bps broken")
SkipIfRootless("FIXME: requested cgroup controller `io` is not available")
SkipIfRootlessCgroupsV1("Setting device-read-iops not supported on cgroupv1 for rootless users")
var session *PodmanSessionIntegration
Expand All @@ -769,6 +773,7 @@ USER bin`, BB)
})

It("podman run device-write-iops test", func() {
SkipIfCgroupV1("FIXME: #15035 - bps broken")
SkipIfRootless("FIXME: requested cgroup controller `io` is not available")
SkipIfRootlessCgroupsV1("Setting device-write-iops not supported on cgroupv1 for rootless users")
var session *PodmanSessionIntegration
Expand Down
17 changes: 17 additions & 0 deletions test/system/005-info.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,24 @@ host.slirp4netns.executable | $expr_path
dprint "# actual=<$actual> expect=<$expect>"
is "$actual" "$expect" "jq .$field"
done
}

@test "podman info - confirm desired runtime" {
if [[ -z "$CI_DESIRED_RUNTIME" ]]; then
# When running in Cirrus, CI_DESIRED_RUNTIME *must* be defined
# in .cirrus.yml so we can double-check that all CI VMs are
# using crun/runc as desired.
if [[ -n "$CIRRUS_CI" ]]; then
die "CIRRUS_CI is set, but CI_DESIRED_RUNTIME is not! See #14912"
fi

# Not running under Cirrus (e.g., gating tests, or dev laptop).
# Totally OK to skip this test.
skip "CI_DESIRED_RUNTIME is unset--OK, because we're not in Cirrus"
fi

run_podman info --format '{{.Host.OCIRuntime.Name}}'
is "$output" "$CI_DESIRED_RUNTIME" "CI_DESIRED_RUNTIME (from .cirrus.yml)"
}

# 2021-04-06 discussed in watercooler: RHEL must never use crun, even if
Expand Down
2 changes: 2 additions & 0 deletions test/system/030-run.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ echo $rand | 0 | $rand
}

@test "podman run - uidmapping has no /sys/kernel mounts" {
skip_if_cgroupsv1 "FIXME: #15025: run --uidmap fails on cgroups v1"
skip_if_rootless "cannot umount as rootless"
skip_if_remote "TODO Fix this for remote case"

Expand Down Expand Up @@ -805,6 +806,7 @@ EOF

# rhbz#1902979 : podman run fails to update /etc/hosts when --uidmap is provided
@test "podman run update /etc/hosts" {
skip_if_cgroupsv1 "FIXME: #15025: run --uidmap fails on cgroups v1"
HOST=$(random_string 25)
run_podman run --uidmap 0:10001:10002 --rm --hostname ${HOST} $IMAGE grep ${HOST} /etc/hosts
is "${lines[0]}" ".*${HOST}.*"
Expand Down
8 changes: 4 additions & 4 deletions test/system/160-volumes.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,16 +149,16 @@ EOF

# By default, volumes are mounted exec, but we have manually added the
# noexec option. This should fail.
# ARGH. Unfortunately, runc (used for cgroups v1) produces a different error
# ARGH. Unfortunately, runc (used for cgroups v1) has different exit status
local expect_rc=126
local expect_msg='.* OCI permission denied.*'
if [[ $(podman_runtime) = "runc" ]]; then
expect_rc=1
expect_msg='.* exec user process caused.*permission denied'
fi

run_podman ${expect_rc} run --rm --volume $myvolume:/vol:noexec,z $IMAGE /vol/myscript
is "$output" "$expect_msg" "run on volume, noexec"
# crun and runc emit different messages, and even runc is inconsistent
# with itself (output changed some time in 2022?). Deal with all.
assert "$output" =~ 'exec.* permission denied' "run on volume, noexec"

# With the default, it should pass
run_podman run --rm -v $myvolume:/vol:z $IMAGE /vol/myscript
Expand Down
2 changes: 2 additions & 0 deletions test/system/170-run-userns.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,13 +30,15 @@ function _require_crun() {
}

@test "podman --group-add without keep-groups while in a userns" {
skip_if_cgroupsv1 "FIXME: #15025: run --uidmap fails on cgroups v1"
skip_if_rootless "chroot is not allowed in rootless mode"
skip_if_remote "--group-add keep-groups not supported in remote mode"
run chroot --groups 1234,5678 / ${PODMAN} run --rm --uidmap 0:200000:5000 --group-add 457 $IMAGE id
is "$output" ".*457" "Check group leaked into container"
}

@test "rootful pod with custom ID mapping" {
skip_if_cgroupsv1 "FIXME: #15025: run --uidmap fails on cgroups v1"
skip_if_rootless "does not work rootless - rootful feature"
random_pod_name=$(random_string 30)
run_podman pod create --uidmap 0:200000:5000 --name=$random_pod_name
Expand Down
5 changes: 2 additions & 3 deletions test/system/200-pod.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,9 +479,8 @@ spec:

@test "pod resource limits" {
skip_if_remote "resource limits only implemented on non-remote"
if is_rootless || ! is_cgroupsv2; then
skip "only meaningful for rootful"
fi
skip_if_rootless "resource limits only work with root"
skip_if_cgroupsv1 "resource limits only meaningful on cgroups V2"

# create loopback device
lofile=${PODMAN_TMPDIR}/disk.img
Expand Down
4 changes: 4 additions & 0 deletions test/system/251-system-service.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ function teardown() {

@test "podman-system-service containers survive service stop" {
skip_if_remote "podman system service unavailable over remote"
local runtime=$(podman_runtime)
if [[ "$runtime" != "crun" ]]; then
skip "survival code only implemented in crun; you're using $runtime"
fi

port=$(random_free_port)
URL=tcp://127.0.0.1:$port
Expand Down
1 change: 1 addition & 0 deletions test/system/400-unprivileged-access.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
load helpers

@test "podman container storage is not accessible by unprivileged users" {
skip_if_cgroupsv1 "FIXME: #15025: run --uidmap fails on cgroups v1"
skip_if_rootless "test meaningless without suid"
skip_if_remote

Expand Down
2 changes: 2 additions & 0 deletions test/system/500-networking.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,7 @@ load helpers

# Issue #5466 - port-forwarding doesn't work with this option and -d
@test "podman networking: port with --userns=keep-id for rootless or --uidmap=* for rootful" {
skip_if_cgroupsv1 "FIXME: #15025: run --uidmap fails on cgroups v1"
for cidr in "" "$(random_rfc1918_subnet).0/24"; do
myport=$(random_free_port 52000-52999)
if [[ -z $cidr ]]; then
Expand Down Expand Up @@ -744,6 +745,7 @@ EOF
}

@test "podman run /etc/* permissions" {
skip_if_cgroupsv1 "FIXME: #15025: run --uidmap fails on cgroups v1"
userns="--userns=keep-id"
if ! is_rootless; then
userns="--uidmap=0:1111111:65536 --gidmap=0:1111111:65536"
Expand Down
4 changes: 2 additions & 2 deletions test/utils/utils.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -367,8 +367,8 @@ func (s *PodmanSession) WaitWithDefaultTimeout() {
func (s *PodmanSession) WaitWithTimeout(timeout int) {
Eventually(s, timeout).Should(Exit(), func() string {
// in case of timeouts show output
return fmt.Sprintf("command %v timed out\nSTDOUT: %s\nSTDERR: %s",
s.Command.Args, string(s.Out.Contents()), string(s.Err.Contents()))
return fmt.Sprintf("command timed out after %ds: %v\nSTDOUT: %s\nSTDERR: %s",
timeout, s.Command.Args, string(s.Out.Contents()), string(s.Err.Contents()))
})
os.Stdout.Sync()
os.Stderr.Sync()
Expand Down